CVE-2026-82237

Name of the Vulnerable Software and Affected Versions filebrowser versions prior to 2.63.24

Description An issue exists where share records are not removed when a shared file is renamed, as only file deletion triggers the cleanup process. Because the share record is keyed by the file path, it remains dormant and returns a 404 error while the path is empty. If a new, unrelated file is subsequently placed at that original path through re-upload, a hook, or by another user with create permissions, the stale public share link will serve the new file using the original link's password and expiry settings, leading to unauthorized exposure.

Recommendations Update to version 2.63.24 or later.